PT-2022-5357 · Adobe · Dimension

Published 2022-10-11 · Updated 2022-10-18 · CVE-2022-38447

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Dimension version 3.4.5

Description The issue is related to a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. This vulnerability is associated with the analysis of SKP files and can be exploited by opening a malicious file, which requires user interaction. Exploitation may allow an attacker to execute arbitrary code using a specially crafted file.

Recommendations For Adobe Dimension version 3.4.5, update to a version that fixes this issue to prevent exploitation. As a temporary workaround, consider avoiding the use of SKP files or restricting access to them until a patch is available.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2022-06671

CVE-2022-38447

ZDI-22-1426

Affected Products

Dimension

References · 6

• https://bdu.fstec.ru/vul/2022-06671 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1426 · Security Note
• https://helpx.adobe.com/security/products/dimension/apsb22-57.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-38447 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38447 · Security Note
• https://t.me/cibsecurity/51516 · Telegram Post